InfoSecBulletin Cybersecurity for mankind
Citrix has issued security updates for a serious vulnerability in the NetScaler Console and NetScaler Agent that could allow privilege escalation in specific situations. The vulnerability, identified as CVE-2024-12284, has been given a CVSS v4 score of 8.8 out of a maximum of 10.0
It involves improper handling of user privileges that could allow a user with access to elevate their permissions and perform additional actions if the NetScaler Console Agent is in use.
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
“The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization,” Netscaler noted.
“However, only authenticated users with existing access to the NetScaler Console can exploit this vulnerability, thereby limiting the threat surface to only authenticated users.”
“The issue impacts the following versions:”
NetScaler Console 14.1 before 14.1-38.53
NetScaler Console 13.1 before 13.1-56.18
NetScaler Agent 14.1 before 14.1-38.53
NetScaler Agent 13.1 before 13.1-56.18
It has been remediated in the below versions of the software –
NetScaler Console 14.1-38.53 and later releases
NetScaler Console 13.1-56.18 and later releases of 13.1
NetScaler Agent 14.1-38.53 and later releases
NetScaler Agent 13.1-56.18 and later releases of 13.1
“Cloud Software Group strongly urges customers of NetScaler Console and NetScaler Agent to install the relevant updated versions as soon as possible,” the company said, adding there are no workarounds to resolve the flaw.
Customers using Citrix-managed NetScaler Console Service do not need to take any action.
